Git-Mirrors/security-misc
1
0
Fork 0
mirror of https://github.com/Kicksecure/security-misc.git synced 2025-05-03 01:34:50 -04:00
Code Issues Projects Releases Packages Wiki Activity

Clarify KSPP compliance header for the undocumented case

Browse source
This commit is contained in:
raja-grewal 2024-10-14 02:54:30 +00:00 • committed by GitHub
parent 263335f74e
commit 09fe46adc9
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
8 changed files with 8 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

1
etc/default/grub.d/40_cpu_mitigations.cfg
View file

@ -5,6 +5,7 @@
## KSPP=yes: compliant with recommendations by the KSPP ## KSPP=yes: compliant with recommendations by the KSPP
## KSPP=partial: partially compliant with recommendations by the KSPP ## KSPP=partial: partially compliant with recommendations by the KSPP
## KSPP=no: not (currently) compliant with recommendations by the KSPP ## KSPP=no: not (currently) compliant with recommendations by the KSPP
## If there is no explicit KSPP compliance notice, the setting is not mentioned by the KSPP.
## Enable known mitigations for CPU vulnerabilities. ## Enable known mitigations for CPU vulnerabilities.
## https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/index.html ## https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/index.html

1
etc/default/grub.d/40_kernel_hardening.cfg
View file

@ -9,6 +9,7 @@ kver="$(dpkg-query --show --showformat='${Version}' "$kpkg")" 2>/dev/null || tru
## KSPP=yes: compliant with recommendations by the KSPP ## KSPP=yes: compliant with recommendations by the KSPP
## KSPP=partial: partially compliant with recommendations by the KSPP ## KSPP=partial: partially compliant with recommendations by the KSPP
## KSPP=no: not (currently) compliant with recommendations by the KSPP ## KSPP=no: not (currently) compliant with recommendations by the KSPP
## If there is no explicit KSPP compliance notice, the setting is not mentioned by the KSPP.
## This configuration file is split into 4 sections: ## This configuration file is split into 4 sections:
## 1. Kernel Space ## 1. Kernel Space

1
etc/default/grub.d/40_remount_secure.cfg
View file

@ -5,6 +5,7 @@
## KSPP=yes: compliant with recommendations by the KSPP ## KSPP=yes: compliant with recommendations by the KSPP
## KSPP=partial: partially compliant with recommendations by the KSPP ## KSPP=partial: partially compliant with recommendations by the KSPP
## KSPP=no: not (currently) compliant with recommendations by the KSPP ## KSPP=no: not (currently) compliant with recommendations by the KSPP
## If there is no explicit KSPP compliance notice, the setting is not mentioned by the KSPP.
## Remount Secure provides enhanced security via mount options: ## Remount Secure provides enhanced security via mount options:
## https://www.kicksecure.com/wiki/Security-misc#Remount_Secure ## https://www.kicksecure.com/wiki/Security-misc#Remount_Secure

1
etc/default/grub.d/40_signed_modules.cfg
View file

@ -5,6 +5,7 @@
## KSPP=yes: compliant with recommendations by the KSPP ## KSPP=yes: compliant with recommendations by the KSPP
## KSPP=partial: partially compliant with recommendations by the KSPP ## KSPP=partial: partially compliant with recommendations by the KSPP
## KSPP=no: not (currently) compliant with recommendations by the KSPP ## KSPP=no: not (currently) compliant with recommendations by the KSPP
## If there is no explicit KSPP compliance notice, the setting is not mentioned by the KSPP.
## Require every kernel module to be signed before being loaded. ## Require every kernel module to be signed before being loaded.
## Any module that is unsigned or signed with an invalid key cannot be loaded. ## Any module that is unsigned or signed with an invalid key cannot be loaded.

1
etc/default/grub.d/41_quiet_boot.cfg
View file

@ -5,6 +5,7 @@
## KSPP=yes: compliant with recommendations by the KSPP ## KSPP=yes: compliant with recommendations by the KSPP
## KSPP=partial: partially compliant with recommendations by the KSPP ## KSPP=partial: partially compliant with recommendations by the KSPP
## KSPP=no: not (currently) compliant with recommendations by the KSPP ## KSPP=no: not (currently) compliant with recommendations by the KSPP
## If there is no explicit KSPP compliance notice, the setting is not mentioned by the KSPP.
## Some default configuration files automatically include the "quiet" parameter. ## Some default configuration files automatically include the "quiet" parameter.
## Therefore, first remove "quiet" from GRUB_CMDLINE_LINUX_DEFAULT since "quiet" must be first. ## Therefore, first remove "quiet" from GRUB_CMDLINE_LINUX_DEFAULT since "quiet" must be first.

1
usr/lib/sysctl.d/30_security-misc_kexec-disable.conf
View file

@ -5,6 +5,7 @@
## KSPP=yes: compliant with recommendations by the KSPP ## KSPP=yes: compliant with recommendations by the KSPP
## KSPP=partial: partially compliant with recommendations by the KSPP ## KSPP=partial: partially compliant with recommendations by the KSPP
## KSPP=no: not (currently) compliant with recommendations by the KSPP ## KSPP=no: not (currently) compliant with recommendations by the KSPP
## If there is no explicit KSPP compliance notice, the setting is not mentioned by the KSPP.
## NOTE: ## NOTE:
## This configuration is in a dedicated file because the ram-wipe package ## This configuration is in a dedicated file because the ram-wipe package

1
usr/lib/sysctl.d/30_silent-kernel-printk.conf
View file

@ -5,6 +5,7 @@
## KSPP=yes: compliant with recommendations by the KSPP ## KSPP=yes: compliant with recommendations by the KSPP
## KSPP=partial: partially compliant with recommendations by the KSPP ## KSPP=partial: partially compliant with recommendations by the KSPP
## KSPP=no: not (currently) compliant with recommendations by the KSPP ## KSPP=no: not (currently) compliant with recommendations by the KSPP
## If there is no explicit KSPP compliance notice, the setting is not mentioned by the KSPP.
## Prevent kernel information leaks in the console during boot. ## Prevent kernel information leaks in the console during boot.
## Must be used in conjunction with kernel boot parameters. ## Must be used in conjunction with kernel boot parameters.

1
usr/lib/sysctl.d/990-security-misc.conf
View file

@ -10,6 +10,7 @@
## KSPP=yes: compliant with recommendations by the KSPP ## KSPP=yes: compliant with recommendations by the KSPP
## KSPP=partial: partially compliant with recommendations by the KSPP ## KSPP=partial: partially compliant with recommendations by the KSPP
## KSPP=no: not (currently) compliant with recommendations by the KSPP ## KSPP=no: not (currently) compliant with recommendations by the KSPP
## If there is no explicit KSPP compliance notice, the setting is not mentioned by the KSPP.
## This configuration file is divided into 5 sections: ## This configuration file is divided into 5 sections:
## 1. Kernel Space ## 1. Kernel Space